From 4c43fb1afebb48c1de2822df1133945ccd92ac97 Mon Sep 17 00:00:00 2001
From: Alexander Medvednikov <alexander@medvednikov.com>
Date: Fri, 12 Jun 2026 08:15:53 +0300
Subject: [PATCH] checker: reject pointer targets in json.decode (#27427)

---
 vlib/v/checker/fn.v                  |  4 +++-
 vlib/v/checker/tests/json_decode.out | 11 +++++++++--
 vlib/v/checker/tests/json_decode.vv  |  1 +
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/vlib/v/checker/fn.v b/vlib/v/checker/fn.v
index 6eb9f806a..4a0686708 100644
--- a/vlib/v/checker/fn.v
+++ b/vlib/v/checker/fn.v
@@ -1716,7 +1716,9 @@ fn (mut c Checker) fn_call(mut node ast.CallExpr, mut continue_check &bool) ast.
 					parent_sym := c.table.sym(ast.new_type(sym.info.parent_idx))
 					kind = parent_sym.kind
 				}
-				if is_json_decode && kind !in [.struct, .sum_type, .map, .array] {
+				if is_json_decode && c.table.fully_unaliased_type(unwrapped_typ).is_ptr() {
+					c.error('${fn_name}: cannot decode into a pointer type', expr.pos)
+				} else if is_json_decode && kind !in [.struct, .sum_type, .map, .array] {
 					c.error('${fn_name}: expected sum type, struct, map or array, found ${kind}',
 						expr.pos)
 				}
diff --git a/vlib/v/checker/tests/json_decode.out b/vlib/v/checker/tests/json_decode.out
index 4d7b569a2..dbd374e35 100644
--- a/vlib/v/checker/tests/json_decode.out
+++ b/vlib/v/checker/tests/json_decode.out
@@ -32,10 +32,17 @@ vlib/v/checker/tests/json_decode.vv:14:14: error: json.decode: expected sum type
    14 |     json.decode(Num, '5')! // BAD
       |                 ~~~
    15 |     json.decode(St, 6)! // BAD
-   16 | }
+   16 |     json.decode(&[]St, '[]')! // BAD
 vlib/v/checker/tests/json_decode.vv:15:7: error: json.decode: second argument needs to be a string
    13 |     json.decode(string, '""')! // BAD
    14 |     json.decode(Num, '5')! // BAD
    15 |     json.decode(St, 6)! // BAD
       |          ~~~~~~~~~~~~~
-   16 | }
+   16 |     json.decode(&[]St, '[]')! // BAD
+   17 | }
+vlib/v/checker/tests/json_decode.vv:16:15: error: json.decode: cannot decode into a pointer type
+   14 |     json.decode(Num, '5')! // BAD
+   15 |     json.decode(St, 6)! // BAD
+   16 |     json.decode(&[]St, '[]')! // BAD
+      |                  ^
+   17 | }
diff --git a/vlib/v/checker/tests/json_decode.vv b/vlib/v/checker/tests/json_decode.vv
index cfca44bb4..858cf17d2 100644
--- a/vlib/v/checker/tests/json_decode.vv
+++ b/vlib/v/checker/tests/json_decode.vv
@@ -13,4 +13,5 @@ fn main() {
 	json.decode(string, '""')! // BAD
 	json.decode(Num, '5')! // BAD
 	json.decode(St, 6)! // BAD
+	json.decode(&[]St, '[]')! // BAD
 }
-- 
2.39.5